Cargo vet PR comment #68
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # This workflow triggers after cargo-vet workflow has run. | |
| # It adds a comment to the PR with the results of the cargo vet run. | |
| # It first adds a comment if the cargo vet run fails, | |
| # and updates the comment if the cargo vet run succeeds after having failed at least once. | |
| name: Cargo vet PR comment | |
| on: | |
| workflow_run: | |
| workflows: [cargo-vet] | |
| types: | |
| - completed | |
| permissions: | |
| contents: read | |
| pull-requests: write | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }} | |
| cancel-in-progress: true | |
| jobs: | |
| find-pr-comment: | |
| # This job runs when the cargo-vet job fails or succeeds | |
| # It will download artifacts from the matrix legs and post a comment on the PR | |
| runs-on: ubuntu-latest | |
| outputs: | |
| comment-id: ${{ steps.get-comment-id.outputs.comment-id }} | |
| pr-number: ${{ steps.get-pr-number.outputs.pr_number }} | |
| if: github.event.workflow_run.event == 'pull_request' && github.event.workflow_run.conclusion != 'cancelled' | |
| steps: | |
| - name: 'Download artifacts' | |
| # cargo-vet workflow uploads one artifact per platform (pr-dev-imxrt, pr-dev-npcx, pr-dev-qemu); | |
| # all contain the same NR file, so merge-multiple lets us read it from any of them. | |
| uses: actions/download-artifact@v4 | |
| with: | |
| github-token: ${{ secrets.GITHUB_TOKEN }} | |
| pattern: pr-* | |
| merge-multiple: true | |
| path: pr/ | |
| run-id: ${{ github.event.workflow_run.id }} | |
| - name: 'Get PR number' | |
| id: get-pr-number | |
| run: echo "pr_number=$(cat ./pr/NR)" >> $GITHUB_OUTPUT | |
| - name: 'Find existing comment' | |
| id: find-comment | |
| uses: peter-evans/find-comment@v3 | |
| with: | |
| issue-number: ${{ steps.get-pr-number.outputs.pr_number }} | |
| comment-author: 'github-actions[bot]' | |
| body-includes: 'comment-tag: [cargo-vet]' | |
| - name: 'Get comment ID' | |
| id: get-comment-id | |
| if: ${{ steps.find-comment.outputs.comment-id != '' }} | |
| run: echo "comment-id=${{ steps.find-comment.outputs.comment-id }}" >> $GITHUB_OUTPUT | |
| post-comment-failure: | |
| # This job runs when the cargo-vet job fails | |
| # It will download the artifact from the failed job and post a comment on the PR | |
| runs-on: ubuntu-latest | |
| needs: find-pr-comment | |
| if: github.event.workflow_run.conclusion == 'failure' | |
| steps: | |
| - name: 'Comment on PR - Failure' | |
| uses: peter-evans/create-or-update-comment@v4 | |
| with: | |
| comment-id: ${{ needs.find-pr-comment.outputs.comment-id }} | |
| issue-number: ${{ needs.find-pr-comment.outputs.pr-number }} | |
| body: | | |
| # Cargo Vet Audit Failed | |
| `cargo vet` has failed for one or more platforms in this PR. See the [cargo-vet workflow run](${{ github.event.workflow_run.html_url }}) for which platform(s) failed, and run `cargo vet --locked` locally from `platform/<dev-*>/` to reproduce. | |
| Details about the vetting process can be found in [docs/supply-chain.md](https://github.com/${{ github.repository }}/blob/${{ github.event.workflow_run.head_sha }}/docs/supply-chain.md). | |
| ## If the unvetted dependencies are not needed | |
| Please modify Cargo.toml file to avoid including the dependencies. | |
| ## If the unvetted dependencies are needed | |
| Post a new comment with the questionnaire below to the PR to help the auditors vet the dependencies. | |
| After the auditors have vetted the dependencies, the PR will need to be rebased to pick up the new audits and pass this check. | |
| ### Copy and paste the questionnaire as a new comment and provide your answers: | |
| **1. What crates (with version) need to be audited?** | |
| **2. How many of the crates are version updates vs new dependencies?** | |
| **3. To confirm none of the already included crates serve your needs, please provide a brief description of the purpose of the new crates.** | |
| **4. Any extra notes to the auditors to help with their audits.** | |
| <!-- | |
| This comment is auto-generated by the cargo-vet workflow. | |
| Please do not edit it directly. | |
| comment-tag: [cargo-vet] | |
| --> | |
| edit-mode: replace | |
| - name: 'Label PR' | |
| uses: actions/github-script@v7 | |
| with: | |
| script: | | |
| github.rest.issues.addLabels({ | |
| issue_number: ${{ needs.find-pr-comment.outputs.pr-number }}, | |
| owner: context.repo.owner, | |
| repo: context.repo.repo, | |
| labels: ['cargo vet'] | |
| }) | |
| post-comment-success: | |
| # This job runs when the cargo-vet job succeeds | |
| # It will update the comment on the PR with a success message | |
| runs-on: ubuntu-latest | |
| needs: find-pr-comment | |
| if: github.event.workflow_run.conclusion == 'success' | |
| steps: | |
| - name: 'Comment on PR - Success' | |
| # Only update the comment if it exists | |
| # This is to avoid creating a new comment if the cargo-vet job has never failed before | |
| if: ${{ needs.find-pr-comment.outputs.comment-id }} | |
| uses: peter-evans/create-or-update-comment@v4 | |
| with: | |
| comment-id: ${{ needs.find-pr-comment.outputs.comment-id }} | |
| issue-number: ${{ needs.find-pr-comment.outputs.pr-number }} | |
| body: | | |
| # Cargo Vet Audit Passed | |
| `cargo vet` has passed in this PR. No new unvetted dependencies were found. | |
| <!-- | |
| This comment is auto-generated by the cargo-vet workflow. | |
| Please do not edit it directly. | |
| comment-tag: [cargo-vet] | |
| --> | |
| edit-mode: replace |